Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'GoogleUpdate140' = '"%LOCALAPPDATA%\Google\Chrome\49ao3yjhys\chrome140.exe" /user'
Creates or modifies the following files
- <SYSTEM32>\tasks\googleupdatetask14049ao3yjhys
Malicious functions
Intercepts control using hardware breakpoints
in NTDLL dll
- gupdt.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\49ao3yjhys\google.dll
- %LOCALAPPDATA%\google\chrome\49ao3yjhys\gupdt.exe
- %LOCALAPPDATA%\google\chrome\49ao3yjhys\gupw.exe
- %LOCALAPPDATA%\google\chrome\49ao3yjhys\chrome140.exe
Network activity
Connects to
- 'xm#####.nanopool.org':10343
TCP
Other
- 'xm#####.nanopool.org':10343
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\google\chrome\49ao3yjhys\gupdt.exe'
- '%LOCALAPPDATA%\google\chrome\49ao3yjhys\gupw.exe' /watchu
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\powercfg.exe' /change standby-timeout-ac 0 monitor-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /change standby-timeout-dc 0 monitor-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /change standby-timeout-ac 0 monitor-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /change standby-timeout-dc 0 monitor-timeout-dc 0' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\49ao3yjhys\gupdt.exe' ' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\49ao3yjhys\gupw.exe' /watchu' (with hidden window)
